TP-Link Tapo C500 up to 2.0 ONVIF PTZ SOAP Handlers stack-based overflow

Summaryinfo

A vulnerability labeled as critical has been found in TP-Link Tapo C500 up to 2.0. Affected is an unknown function of the component ONVIF PTZ SOAP Handlers. Executing a manipulation can lead to stack-based overflow. The identification of this vulnerability is CVE-2026-104945. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability classified as critical was found in TP-Link Tapo C500 up to 2.0. This vulnerability affects an unknown part of the component ONVIF PTZ SOAP Handlers. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect availability. CVE summarizes:

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected service. Successful exploitation may allow an authenticated attacker to cause the affected service to crash, resulting in a denial-of-service condition. Repeated exploitation may repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts.

The advisory is shared for download at tp-link.com. This vulnerability was named CVE-2026-104945 since 10/02/2026. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/06/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• TP-Link

Name

• Tapo C500

Version

• 2.0

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion